SnowPro Advanced: Security Engineer Question 185
Single answer2.5 Configure object tagging and data classification frameworks.A financial services company wants to standardize how sensitive data is identified and labeled in Snowflake so that downstream controls can rely on consistent metadata. The security team has already created a set of governance tags such as DATA_SENSITIVITY and DATA_OWNER. They now want to automatically discover likely sensitive columns in newly onboarded tables and then apply the approved governance tags to those columns for reporting and policy enforcement. Which approach best meets this requirement with the least manual effort?
- A
Run Snowflake sensitive data classification on the target tables to generate system classification results, review the findings, and then map/apply the organization’s governance tags to the identified columns.
- B
Create a masking policy first, because masking policies automatically classify columns and populate governance tags when the policy is attached to a table.
- C
Use object comments and table descriptions to store sensitivity labels, because Snowflake classification reads comments and converts them into tags automatically.
- D
Grant the APPLY TAG privilege to all analysts so they can manually label columns during query execution based on the result set they see.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Snowflake’s sensitive data classification capability to automatically inspect data and identify likely sensitive columns, then apply the organization’s governance tags to those objects. This separates discovery from governance labeling in a controlled, scalable way. In practice, organizations often define a standard set of tags for sensitivity, ownership, retention, or regulatory scope, and then use classification results to drive tagging workflows. Those tags can then support governance reporting and be referenced by downstream controls where appropriate. Snowflake documentation and best practices distinguish among classification, tagging, and protection controls such as masking policies: classification helps identify sensitive data, tags provide standardized metadata on objects, and masking policies enforce access behavior. This question tests whether the candidate understands how these governance capabilities fit together rather than confusing them with comments, ad hoc manual processes, or masking alone.
- A. Correct.
Correct. Snowflake provides sensitive data classification capabilities to analyze columns and identify likely sensitive data types. Those results help teams review discovered classifications and then apply their own governance tags, such as DATA_SENSITIVITY or DATA_OWNER, to the relevant objects. This approach aligns with a practical governance model: use automated discovery to reduce manual effort, then apply standardized tags that downstream controls and reporting can use.
- B. Incorrect.
Incorrect. Masking policies protect data access, but they do not perform automatic sensitive data discovery or automatically populate governance tags simply because a policy exists. A common misconception is that protection mechanisms and classification mechanisms are the same. In Snowflake, classification and tagging are related governance activities, while masking policies are separate controls that can consume metadata such as roles, tags, or context.
- C. Incorrect.
Incorrect. Comments and descriptions are useful for human-readable documentation, but Snowflake does not automatically convert object comments into governance tags or use comments as the authoritative classification framework. Relying on comments would create inconsistent metadata and would not support standardized tag-based governance.
- D. Incorrect.
Incorrect. Allowing broad manual tagging by analysts is not the least-effort or best-governed solution. Tags should be managed through controlled governance processes and appropriate privileges. Also, tagging objects during query execution based on result sets is not how Snowflake object tagging works; tags are applied to supported securable objects and columns, not ad hoc query outputs.